1ipa-ca-install(1)              IPA Manual Pages              ipa-ca-install(1)
2
3
4

NAME

6       ipa-ca-install - Install a CA on a server
7

SYNOPSIS

9   DOMAIN LEVEL 0
10       ipa-ca-install [OPTION]... [replica_file]
11
12   DOMAIN LEVEL 1
13       ipa-ca-install [OPTION]...
14

DESCRIPTION

16       Adds  a CA as an IPA-managed service. This requires that the IPA server
17       is already installed and configured.
18
19       In a domain at domain level  0,  you  can  run  ipa-ca-install  without
20       replica_file  to  upgrade from CA-less to CA-full, or with replica_file
21       to install the CA service on the replica.
22
23       The replica_file is created using the ipa-replica-prepare  utility  and
24       should be the same one used when originally installing the replica.
25
26       In  a  domain  at domain level 1, ipa-ca-install can be used to upgrade
27       from CA-less to CA-full or to install the CA service on a replica,  and
28       does not require any replica file.
29

OPTIONS

31       -d, --debug Enable debug logging when more verbose output is needed
32
33       -p DM_PASSWORD, --password=DM_PASSWORD
34              Directory Manager (existing master) password
35
36       -w ADMIN_PASSWORD, --admin-password=ADMIN_PASSWORD
37              Admin user Kerberos password used for connection check
38
39       --external-ca
40              Generate  a  CSR  for  the IPA CA certificate to be signed by an
41              external CA.
42
43       --external-ca-type=TYPE
44              Type of the external CA. Possible values are "generic", "ms-cs".
45              Default  value is "generic". Use "ms-cs" to include the template
46              name required by Microsoft Certificate Services (MS CS)  in  the
47              generated CSR (see --external-ca-profile for full details).
48
49
50       --external-ca-profile=PROFILE_SPEC
51              Specify the certificate profile or template to use at the exter‐
52              nal CA.
53
54              When --external-ca-type is "ms-cs" the following specifiers  may
55              be used:
56
57
58              <oid>:<majorVersion>[:<minorVersion>]
59                     Specify  a certificate template by OID and major version,
60                     optionally also specifying minor version.
61
62              <name> Specify a certificate template by name.  The name  cannot
63                     contain  any : characters and cannot be an OID (otherwise
64                     the OID-based  template  specifier  syntax  takes  prece‐
65                     dence).
66
67              default
68                     If no template is specified, the template name "SubCA" is
69                     used.
70
71
72       --external-cert-file=FILE
73              File containing the IPA CA certificate and the external CA  cer‐
74              tificate  chain. The file is accepted in PEM and DER certificate
75              and PKCS#7 certificate chain formats. This option  may  be  used
76              multiple times.
77
78       --ca-subject=SUBJECT
79              The  CA  certificate  subject DN (default CN=Certificate Author‐
80              ity,O=REALM.NAME).  RDNs are in LDAP order  (most  specific  RDN
81              first).
82
83       --subject-base=SUBJECT
84              The  subject  base  for  certificates  issued  by  IPA  (default
85              O=REALM.NAME).  RDNs  are  in  LDAP  order  (most  specific  RDN
86              first).
87
88       --ca-signing-algorithm=ALGORITHM
89              Signing algorithm of the IPA CA certificate. Possible values are
90              SHA1withRSA,  SHA256withRSA,  SHA512withRSA.  Default  value  is
91              SHA256withRSA.  Use this option with --external-ca if the exter‐
92              nal CA does not support the default signing algorithm.
93
94       --no-host-dns
95              Do not use DNS for hostname lookup during installation
96
97       --skip-conncheck
98              Skip connection check to remote master
99
100       --skip-schema-check
101              Skip check for updated CA DS schema on the remote master
102
103       -U, --unattended
104              An unattended installation that will never prompt for user input
105

EXIT STATUS

107       0 if the command was successful
108
109       1 if an error occurred
110
111
112
113IPA                               Mar 30 2017                ipa-ca-install(1)
Impressum